Network management and monitoring
Networks must be configured, watched, and fixed by the people who run them. Network management combines protocols, data, and practices to keep networks healthy.
What network management covers
Network management includes configuring devices, monitoring performance and faults, managing capacity, ensuring security, and accounting for usage. The classic FCAPS model lists five areas: fault, configuration, accounting, performance, and security management. Managers need visibility into thousands of devices and links, often across many locations.
SNMP and MIBs
The Simple Network Management Protocol (SNMP), dating from 1988 with SNMPv3 adding security, lets a manager poll devices for values and receive traps (alerts). Each device exposes a Management Information Base (MIB), a structured set of variables such as interface counters, error rates, and CPU load, identified by object identifiers. SNMP remains widespread, though newer approaches are replacing it.
Streaming telemetry
Polling every few minutes misses short spikes and scales poorly. Streaming telemetry has devices push structured data, such as interface statistics every few seconds, to collectors using protocols like gNMI with data models defined in YANG. This gives finer-grained, more timely visibility for large networks.
Flow monitoring
Flow records summarise traffic: for each flow, defined by source and destination addresses, ports, and protocol, routers export byte and packet counts and timing. NetFlow, from Cisco, and the standard IPFIX let operators see who is talking to whom, plan capacity, bill customers, and detect anomalies such as DDoS attacks. Sampling one packet in N keeps overhead manageable on fast links.
Troubleshooting tools
Everyday tools include ping (reachability and RTT), traceroute and mtr (path and per-hop delay), nslookup and dig (DNS), tcpdump and Wireshark (packet capture and protocol decoding), iperf (throughput testing), and interface counters for errors and drops. Good troubleshooting moves systematically, often layer by layer: physical link, addressing, routing, DNS, then application.
Configuration management
Manually configuring devices one at a time leads to errors and drift between intended and actual settings. NETCONF and RESTCONF provide programmatic, transactional configuration using YANG models, and automation tools such as Ansible push consistent configurations from version-controlled templates. Many outages trace back to configuration mistakes, so changes are reviewed, tested, and rolled out gradually.
Reliability engineering
Operators set objectives for availability and latency and design for failure: redundant links and devices, diverse paths, and fast failover. Major outages, such as a 2021 incident in which a configuration change disconnected Facebook's backbone and took its services offline for about six hours, show how dependent services are on correct configuration and how important safe change processes are.
Worked example
Users report that a website is slow. ping to the server shows 20 ms RTT and no loss, so basic reachability is fine. mtr shows loss starting at the third hop and persisting to the destination, pointing to a congested or faulty link there. Interface counters on that router reveal rising output drops on one uplink, and flow records show a large backup job saturating it. Rescheduling the backup restores normal performance.
Key takeaways
Network management spans fault, configuration, accounting, performance, and security (FCAPS). SNMP (1988, secured in SNMPv3) polls MIB variables and receives traps; streaming telemetry with gNMI and YANG pushes timely data. NetFlow and IPFIX summarise traffic flows for capacity planning and anomaly detection. ping, traceroute, mtr, dig, tcpdump, Wireshark, and iperf support layered troubleshooting. NETCONF, RESTCONF, and automation tools manage configurations consistently. Reliability engineering builds redundancy and safe change processes, as outages like Facebook's 2021 backbone failure show.
Flashcard
Fault, configuration, accounting, performance, security
Check your understanding
An operator wants to know which hosts are consuming most of an uplink's capacity. Which data source fits best?